dsh-fleet-audit

In distributed or multi-Agent environments, sensitive credentials are often scattered across configuration files, environment variables, and Git remote URLs. A common pitfall is embedding passwords or tokens directly into git remote URLs, which leads to significant security leaks in logs and CI pipelines. dsh-fleet-audit is a read-only, zero-dependency audit tool designed specifically for checking DSH fleet credential hygiene. It recursively scans permissions of common credential files, identifies embedded credentials in .git/config and .gitconfig, and detects common Provider Token prefixes. Crucially, it provides fully masked output, ensuring no plaintext is ever exposed. Whether you are a developer or DevOps engineer, this plugin serves as the first line of defense for security baseline checks, helping you identify and mitigate credential leakage risks early.